<?php
/**
 * REST access to the library: reserved to users who can edit products. The core controller lets anyone read the
 * published posts of a post type shown in REST, and the internal titles of the library are not meant for visitors.
 *
 * @package Prodtabs
 */

namespace Prodtabs;

defined( 'ABSPATH' ) || exit;

/**
 * Posts controller with editor-only read access.
 */
final class Library_Rest_Controller extends \WP_REST_Posts_Controller {

	/**
	 * Listing requires the right to edit products.
	 *
	 * @param \WP_REST_Request $request Request.
	 * @return true|\WP_Error
	 */
	public function get_items_permissions_check( $request ) {
		$type = get_post_type_object( $this->post_type );
		if ( ! $type || ! current_user_can( $type->cap->edit_posts ) ) {
			return new \WP_Error( 'rest_forbidden', __( 'Sorry, you are not allowed to read shared tabs.', 'prodtabs' ), array( 'status' => rest_authorization_required_code() ) );
		}
		return parent::get_items_permissions_check( $request );
	}

	/**
	 * Reading one tab requires the right to edit it.
	 *
	 * @param \WP_REST_Request $request Request.
	 * @return true|\WP_Error
	 */
	public function get_item_permissions_check( $request ) {
		if ( ! current_user_can( 'edit_post', (int) $request['id'] ) ) {
			return new \WP_Error( 'rest_forbidden', __( 'Sorry, you are not allowed to read this shared tab.', 'prodtabs' ), array( 'status' => rest_authorization_required_code() ) );
		}
		return parent::get_item_permissions_check( $request );
	}
}